Security Researchers from Positive Technologies have
recently revealed information about a buffer overflow they stumbled upon in the
firmware update of Intel's management engine 11's which is secret. They stated
that the Intel firmware update could be attacked by sophisticated individuals
to gain access to ME functionality despite being turned off. This clearly means
that sophisticated intruders would be able to play real money slots from the system
they attack despite a firmware update being released by the chipmaker. The
researchers have also claimed that the firmware update released by the
manufacturer may not be significant to permanently resolve the issues.

The Intel management engine which is also known as the
Intel ME resides in the controller hub of the platform and is a co-processor
which powers the remote administrative features of the company. It has its own
operating system which is the Intel Minix 3 that is similar to the Intel UNIX
operating system. It has been designed to monitor computers and has access
comprehensively to all the data and processes of the primary system.

The researchers stumbled upon four vulnerabilities
which affected firmware Intel ME versions 11.0 to 11.20. Two of the
vulnerabilities were found in earlier versions of the firmware belonging to
Intel ME along with two in server platform services and a couple in the trusted
Intel execution engine version 3.0.

A security audit was conducted by Intel after the
firmware update warnings were issued by the researchers for identifying and
exploring the vulnerabilities of the firmware update which were affecting the
Intel ME. Intel issued a statement to its users on November 20 they were
responding to issues discovered by external researchers about the firmware
update and therefore they had completed a comprehensive security review of the
flaws which were identified with the objective of enhancing the resilience of
their firmware.

Firmware Intel identified the issues for their
management engine, trusted execution engine and Intel server platform services
and decided to issue a firmware update to resolve the issues plaguing the ME
platform. The researchers, however, believe that the firmware update released
by Intel does not prevent an intruder from using other methods for the attack
which was also patched by the chipmaker during a recent firmware update.

The chipmaker has not responded positively when
questioned about whether they had any plans to modify the way their management
engine works or to begin producing chips without the ME. A spokesperson for the
company provided a recommendation that requests such as these should be
forwarded to the hardware vendors.

The spokesperson for the company issued a statement
saying that the management engine is capable of providing important
functionality for its users and includes features such as two-factor
authentication, enterprise service management and even the option to get heart bingo reviews. They advised
system owners with customers requirements to contact equipment manufacturers
for the kind of request being put forward to the chipmakers. The company,
however, confirmed that it would not support any configuration which would
remove the functionality essential in most of their mainstream products apart
from providing the firmware update.

The statement issued by the chipmaker certainly comes
as a surprise since Intel has been one of the leading firmware manufacturers of
such products throughout the world for a number of years. It has also issued a
firmware update whenever needed.